The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade openvswitch-debuginfoUpgrade dpdk-docUpgrade dpdk-toolsUpgrade dpdk-debuginfoUpgrade dpdk-develUpgrade openvswitch-develUpgrade openvswitchUpgrade openvswitch-ovn-centralUpgrade openvswitch-ovn-vtepUpgrade openvswitch-testUpgrade dpdkUpgrade python-openvswitchUpgrade openvswitch-ovn-commonUpgrade openvswitch-ovn-host | Aug 28, 2019 | Apr 24, 2018 |
| Debian | — | Upgrade dpdk | Jul 30, 2024 | Apr 24, 2018 |
| Redhat_linux | — | Upgrade dpdk-develUpgrade openvswitch-ovn-hostUpgrade python-openvswitchUpgrade dpdk-debuginfoUpgrade openvswitch-ovn-centralUpgrade openvswitchUpgrade openvswitch-testUpgrade openvswitch-ovn-vtepUpgrade dpdkUpgrade openvswitch-ovn-commonUpgrade dpdk-docUpgrade openvswitch-debuginfoUpgrade openvswitch-develNo solution existsUpgrade dpdk-tools | May 1, 2018 | Apr 24, 2018 |
| Suse | — | Upgrade libdpdk-18_11Upgrade dpdk-toolsUpgrade dpdk-kmp-defaultUpgrade libdpdk-17_11-0Upgrade dpdk-thunderx-kmp-defaultUpgrade dpdk-thunderxUpgrade libdpdk-17_11Upgrade dpdk-thunderx-develUpgrade dpdkUpgrade dpdk-develUpgrade libdpdk-20_0 | Jun 4, 2018 | Apr 24, 2018 |
| Ubuntu | — | Upgrade dpdk | May 17, 2018 | Apr 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub